vidar | 26285efdd77665c7dd35aa0450f77214644ebb80fb284e071e67f728881c8983

General

Target

1e981e240cc21580c970db894934da5f.exe
Size

800KB
MD5

1e981e240cc21580c970db894934da5f
SHA1

24bc2e53f10324268b5ba1542568d9e998a1052b
SHA256

26285efdd77665c7dd35aa0450f77214644ebb80fb284e071e67f728881c8983
SHA512

24c9968c7fbe3f341801e723be26dc083939238a94234374e1eb7821360119e6c8efdcd481ab68de2007fcae1a39b897f4b1198cc43a965577a0982272413844
SSDEEP

24576:qscQPFc8HTWK0g+W2r2smDvDXv4gi+SNYlIGVHWVzM:qxQSUDV+W2aB7v4gINYK4

Score

10^/10

vidar 921 spyware stealer

Malware Config

Extracted

Family

vidar

Version

39.9

Botnet

921

C2

https://prophefliloc.tumblr.com/

Attributes

profile_id
921

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 6 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/3180-7-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3180-8-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3180-10-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3180-11-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3180-22-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/3180-67-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

1e981e240cc21580c970db894934da5f.exe

description pid process target process

PID 1828 set thread context of 3180 1828 1e981e240cc21580c970db894934da5f.exe 1e981e240cc21580c970db894934da5f.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

636 3180 WerFault.exe 1e981e240cc21580c970db894934da5f.exe

description	pid	process	target process
PID 1828 set thread context of 3180	1828	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe

pid	pid_target	process	target process
636	3180	WerFault.exe	1e981e240cc21580c970db894934da5f.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

1e981e240cc21580c970db894934da5f.exe

pid	process
3180	1e981e240cc21580c970db894934da5f.exe
3180	1e981e240cc21580c970db894934da5f.exe
3180	1e981e240cc21580c970db894934da5f.exe
3180	1e981e240cc21580c970db894934da5f.exe
3180	1e981e240cc21580c970db894934da5f.exe
3180	1e981e240cc21580c970db894934da5f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1e981e240cc21580c970db894934da5f.exe

description pid process

Token: SeDebugPrivilege 1828 1e981e240cc21580c970db894934da5f.exe

description	pid	process
Token: SeDebugPrivilege	1828	1e981e240cc21580c970db894934da5f.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1e981e240cc21580c970db894934da5f.exe

description	pid	process	target process
PID 1828 wrote to memory of 3180	1828	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1828 wrote to memory of 3180	1828	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1828 wrote to memory of 3180	1828	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1828 wrote to memory of 3180	1828	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1828 wrote to memory of 3180	1828	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1828 wrote to memory of 3180	1828	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1828 wrote to memory of 3180	1828	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe
PID 1828 wrote to memory of 3180	1828	1e981e240cc21580c970db894934da5f.exe	1e981e240cc21580c970db894934da5f.exe

C:\Users\Admin\AppData\Local\Temp\1e981e240cc21580c970db894934da5f.exe
"C:\Users\Admin\AppData\Local\Temp\1e981e240cc21580c970db894934da5f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828

C:\Users\Admin\AppData\Local\Temp\1e981e240cc21580c970db894934da5f.exe
C:\Users\Admin\AppData\Local\Temp\1e981e240cc21580c970db894934da5f.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1764
3⤵
- Program crash
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3180 -ip 3180
1⤵
PID:4112

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1828-6-0x00000000053C0000-0x00000000053E6000-memory.dmp

Filesize
152KB

Download
memory/1828-0-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/1828-2-0x0000000005870000-0x0000000005E14000-memory.dmp

Filesize
5.6MB

Download
memory/1828-3-0x00000000051D0000-0x0000000005262000-memory.dmp

Filesize
584KB

Download
memory/1828-4-0x0000000005400000-0x0000000005410000-memory.dmp

Filesize
64KB

Download
memory/1828-5-0x0000000005290000-0x000000000529A000-memory.dmp

Filesize
40KB

Download
memory/1828-1-0x0000000000870000-0x000000000093C000-memory.dmp

Filesize
816KB

Download
memory/1828-12-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/3180-11-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3180-10-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3180-8-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3180-7-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3180-22-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/3180-67-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads